Resubmissions

21-10-2021 11:49

211021-nzczcsacb2 10

20-10-2021 14:55

211020-sagcpshbf9 10

19-10-2021 14:57

211019-sb3bkaghgn 10

19-10-2021 14:24

211019-rqq2eagab5 10

General

  • Target

    malware.exe

  • Size

    11MB

  • Sample

    211020-sagcpshbf9

  • MD5

    5544ca0d55ecf9e4f1a738f01bcebe84

  • SHA1

    54cf5562fd1e992baff6060f5262cecf5449fe1c

  • SHA256

    37aa2beb667b66b5b548722f4a5b7c72d01b191c538e4ad1acb9467cbc5d8727

  • SHA512

    676bd327e881bfea4134e60c97cf67fb500dc261d2e3515762ed098e9e56eb558fbec159a1af593aafcdb53f4892e33a5a28fe895be89a9f90c340cde68ba71f

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

smokeloader

Version

2020

C2

http://gejajoo7.top/

http://sysaheu9.top/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

media18

C2

91.121.67.60:2151

Extracted

Family

vidar

Version

41.5

Botnet

937

C2

https://mas.to/@xeroxxx

Attributes
profile_id
937

Extracted

Family

redline

Botnet

fucker2

C2

135.181.129.119:4805

Extracted

Family

raccoon

Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5

Attributes
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
rc4.plain
rc4.plain

Extracted

Family

vidar

Version

41.5

Botnet

1028

C2

https://mas.to/@xeroxxx

Attributes
profile_id
1028

Extracted

Family

raccoon

Botnet

7c9b4504a63ed23664e38808e65948379b790395

Attributes
url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar
rc4.plain
rc4.plain

Targets

    • Target

      malware.exe

    • Size

      11MB

    • MD5

      5544ca0d55ecf9e4f1a738f01bcebe84

    • SHA1

      54cf5562fd1e992baff6060f5262cecf5449fe1c

    • SHA256

      37aa2beb667b66b5b548722f4a5b7c72d01b191c538e4ad1acb9467cbc5d8727

    • SHA512

      676bd327e881bfea4134e60c97cf67fb500dc261d2e3515762ed098e9e56eb558fbec159a1af593aafcdb53f4892e33a5a28fe895be89a9f90c340cde68ba71f

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Modifies Windows Defender Real-time Protection settings

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

    • Socelars Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Possible privilege escalation attempt

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks